The Minecraft Admin Panel (mc-admin.byers.cc)¶
A web panel for looking after our three Minecraft Bedrock worlds without touching a terminal. Anyone in the family with access can start/stop worlds, manage who's allowed to join, restore a backup, and peek at the logs.
Address: https://mc-admin.byers.cc
You'll hit a Cloudflare login screen first — sign in with your email and the one-time code it sends you. Only approved emails get in; there is no separate panel password.
Which world is which?
| Panel name | What it is | Game port |
|---|---|---|
| Creative | The main creative world | 19132 |
| Rorys Friends Creative | Rory's world for friends | 19134 |
| Survival World | Classic survival | 19136 |
The four pages¶
Dashboard¶
One card per world showing:
- Up/down badge, uptime, and memory use
- Bedrock version, world name, world size on disk, and game port
- Who's online right now (player names as chips)
Each card has Start / Restart / Stop buttons. Stop asks "are you sure?" first because it kicks everyone off. Restart takes about 30 seconds — players see a brief disconnect and can rejoin straight away.
Allowlist¶
Who is allowed to join each world. This is the page you'll use most.
- Adding someone: type their Xbox gamertag exactly as it appears in Minecraft (letters, numbers and spaces only), tick which world(s) to add them to, and submit.
- Removing someone: find their name under the world and click remove.
Adding or removing a player restarts that world
Bedrock only re-reads the allowlist on startup, so the panel automatically restarts the affected world after every change. Anyone playing gets a short disconnect — best done when the world is quiet, but it is harmless.
Backups¶
Every world is backed up automatically every night. This page lists the backups for each world with a date and size, newest first.
To roll a world back (griefing, corrupted build, "I liked it better yesterday"):
- Pick the backup you want and click Restore.
- Read the confirmation page carefully — it tells you exactly which world will be replaced — then confirm.
- The panel stops the world, saves a safety copy of the current world first, swaps in the backup, and starts the world again. It takes a minute or two.
Nothing is ever silently thrown away: the pre-restore safety copy lands in manual-backups on the server, so even a mistaken restore can be undone. If the backup file turns out to be bad, the restore aborts and the current world is left untouched.
Logs¶
Recent server output for each world (choose how many lines), plus a list of player joins and leaves over the last 7 days. Useful for "when was so-and-so last on?" and for spotting crashes.
Operator appendix¶
The section above is for everyone. This bit is for Elliott.
| Item | Value |
|---|---|
| Code | /home/minecraft/allowlist-web/app.py on the minecraft VM (single-file Python stdlib HTTP server) |
| Service | minecraft-allowlist-web.service, listens on 0.0.0.0:8080 |
| Runs as | root (needed for systemctl and restore file swaps) |
| Exposure | cloudflared tunnel → NPM on the VPS → Cloudflare Access in front of mc-admin.byers.cc |
| Auth | Cloudflare Access email OTP only — the app itself has no auth |
Routes map 1:1 to the nav: / (dashboard + /power POST), /allowlist (add/remove POST, gamertag regex-validated, auto-restart via systemctl restart), /backups (+ restore confirm page and POST), /logs (journalctl tail, 20–500 lines).
Restore flow internals: systemctl stop → tar safety copy of the live world into /home/minecraft/manual-backups/ → extract backup into a staging dir and verify level.dat exists → swap directories → systemctl start. Backups it lists are the nightly backup_YYYYMMDD_HHMMSS.tar.gz files under /home/minecraft/bedrock_backups/<world-dir>/ (created by autoupdate.sh, and picked up by the kopia daily snapshot).
Known hardening TODO: the panel runs as root
The whole HTTP server runs as root because it shells out to systemctl
and rewrites world directories. Cloudflare Access is the only thing
between the internet and a root process. Acceptable for now (tiny
stdlib app, no file uploads, regex-validated inputs), but the clean fix
is a dedicated user plus polkit/sudoers rules for the specific
systemctl verbs. Tracked in security posture.
Adding a new world to the panel = add an entry to the SERVERS dict at the top of app.py (key, label, dir, service) and restart minecraft-allowlist-web.service. See Provisioning a new world.